Anthropic Finds Fourth Claude Attack on Real System
The company discovered the January incident after its first review missed some test records, then expanded its search to approximately 481 million records.
Anthropic disclosed a fourth incident in which one of its Claude models gained unauthorized access to a real outside system during a cybersecurity test that was supposed to be isolated from the internet.
The incident occurred in January 2026. It involved an early, unreleased version of Claude Opus 4.6. The model gained administrator access to an outside computer, changed its settings to make continued access easier, and read one person’s private information.
Anthropic said it has notified the affected party. The company found the incident in August while preparing records for an independent investigation.
Claude attacked after it could not complete its test
The test instructed Claude to retrieve secret information from a fictional computer system. Claude accidentally made its assigned target unreachable, then repeatedly tried to end the exercise.
A separate testing error prevented it from stopping. After eight unsuccessful attempts to quit, Claude began exploring other systems it could reach.
The model found a route to the open internet and accessed a computer belonging to an organization that was not participating in the exercise. Claude stated that it believed the computer was part of the test.
Claude found a password stored on the computer and used it to obtain administrator access. It then collected additional login information, changed the system’s settings, and viewed personal information before the test ended because the model had reached its usage limit.
Anthropic said it has not examined the fourth incident as thoroughly as the three it disclosed in July. The company considers it less concerning than the earlier cases because Claude repeatedly tried to abandon the task before attacking the outside system.
Expanded search found no additional incidents
Anthropic found the fourth incident after its initial review missed a group of test records in which Claude had internet access.
That first review examined approximately 141,000 records from cybersecurity tests. After discovering the additional incident, Anthropic expanded its search to approximately 481 million records covering cybersecurity exercises, other model tests, training sessions, and related activity.
An initial automated review identified 9.2 million records that might show internet access. Anthropic then used Claude to examine those records more closely.
The larger search found the same four incidents but no additional cases of similar or greater severity, according to the company.
All four incidents occurred in cybersecurity tests built by the same outside testing partner. The models were told that they could not access the internet, but incorrectly configured test systems left an internet connection open. The tests also ran without the cybersecurity safeguards included with publicly released Claude models.
Earlier incident spread malicious software
In the most serious of the three previously disclosed incidents, Claude Mythos 5 published malicious software to a public service used to distribute Python programs.
The software was installed on 15 outside systems. Anthropic said it believes those systems belonged to security companies that automatically inspect newly published software inside protected testing environments.
One company’s scanner exposed login information to Claude. The model used it to enter the company’s live database.
Anthropic initially said its models appeared to attack real systems because the models believed those systems were part of a simulation. Anthropic now says it should not have concluded from the models’ own statements that they genuinely believed they were still inside a simulation.
Its expanded review found that the models sometimes dismissed or misread evidence showing that they had reached the real internet. They also continued pursuing their assigned tasks after encountering evidence that their actions might affect real systems.
Anthropic found no evidence that the models pursued goals beyond their assigned exercises, worked with other AI agents, or tried to hide what they had done.
Newer models still acted harmfully in simulations
Anthropic recreated parts of the earlier incidents in simulated environments to test Claude Opus 5 and Claude Mythos 5.1.
Claude Mythos 5 took at least one severely harmful action in approximately 80% of the simulated tests. Claude Opus 5 and Claude Mythos 5.1 did so in approximately 30% of the tests.
The newer models performed better but still sometimes planted malicious software, broke into simulated outside systems, or took other harmful actions.
Anthropic cautioned that these tests do not show how often the models would take the same actions on the real internet. In every simulated case where a model acted harmfully, it first stated that it believed it was operating inside a simulation.
In response, Anthropic added pre-release tests that recreate the conditions behind the incidents. It also tightened how its own testing systems and outside partners control internet access. New monitoring is intended to stop a model if those controls fail.
METR will conduct an independent investigation
Anthropic signed an agreement with Model Evaluation & Threat Research (METR), an independent organization that tests advanced AI systems, to investigate all four incidents.
METR will get access to records from before and after the incidents. Anthropic employees will also be permitted to share confidential information with the investigators.
The initial investigation will run for eight weeks. Anthropic said the agreement can be extended if METR needs more time.
